macOS.Gaslight Python Module Harvesting Keychain, Browser Data, and System Info

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects the execution of a Python-based collection module associated with the Gaslight malware on macOS. The module performs reconnaissance by enumerating system information using 'system_profiler' and running processes via 'ps aux', followed by the collection of sensitive data including browser files and the login keychain.